# CVE-2026-9226: Devolutions Server Azure AD authentication bypass

Source: https://junglewise.ai/threats/cve-2026-9226-authentication-bypass-in-the-azure-ad-external-login-flow-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-9226 · Severity: info · Published 2026-10-06

Devolutions Server is a remote desktop and credential management platform used to secure access to IT infrastructure. An authentication bypass vulnerability in its Azure AD external login feature allows attackers to take over user accounts by replaying captured login tokens from redirect URLs, potentially giving attackers full administrative access to managed systems and credentials.

Technologies: [Devolutions Server](https://junglewise.ai/threats/technologies/devolutions-server). Vendors: [Devolutions](https://junglewise.ai/threats/vendors/devolutions).

## Quick answers

**Is CVE-2026-9226 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9226 being exploited in the wild.

**How severe is CVE-2026-9226?** Informational severity, published 6 October 2026.

**Which products and versions are affected?** Devolutions Server 2026.3.7.0 and earlier.

**Is there a fix for CVE-2026-9226?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9226 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-9226?** Check whether you run Devolutions Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a token replay flaw in the Azure AD external login flow where session tokens are exposed in redirect URLs. An attacker who captures the redirect URL during a login attempt can reuse the token to authenticate as that user without credentials. This affects Devolutions Server 2026.3.7.0 and earlier.

## Affected products

- Devolutions Server 2026.3.7.0 and earlier

## Timeline

- 2026-10-06: disclosed

## References

- [https://devolutions.net/security/advisories/DEVO-2026-0035/](https://devolutions.net/security/advisories/DEVO-2026-0035/)

## Related threats

- [Devolutions Server improper access control in autofill vault search](https://junglewise.ai/threats/cve-2026-126332-improper-access-control-in-the-autofill-vault-search-in)
- [Devolutions Server sensitive information disclosure in user list endpoint](https://junglewise.ai/threats/cve-2026-126331-insertion-of-sensitive-information-into-sent-data-in-the-user)
- [Devolutions Server sensitive information disclosure in user endpoints](https://junglewise.ai/threats/cve-2026-126328-insertion-of-sensitive-information-into-sent-data-in-the-user)
- [Devolutions Server improper access control in connection history](https://junglewise.ai/threats/cve-2026-126327-improper-access-control-in-the-connection-history-in-devolutions)
- [Devolutions Server privilege escalation via role assignment endpoint](https://junglewise.ai/threats/cve-2026-126326-improper-access-control-in-the-administrative-role-assignment)